The vulnerability is a use-after-free in ImageMagick's -fx option that occurs when a memory allocation fails during a specific operation. It allows an attacker who supplies a crafted -fx expression under memory pressure to access freed memory, potentially leading to application crashes or memory corruption. The weaknesses are classified as CWE-476 and CWE-825. Based on the description, it is inferred that the attack requires an attacker‑supplied expression and sufficient memory pressure.

Affected versions of ImageMagick range from 7.1.0-20 up to, but not including, 7.1.2-32. All builds between these releases are vulnerable. The vendor is ImageMagick, product ImageMagick.

The CVSS base score of 2.0 indicates low severity. EPSS is not available and the flaw is not listed in the CISA KEV catalog, implying limited exploitation in the wild. The attack requires the ability to supply a crafted -fx expression and to induce a memory allocation failure by applying memory pressure, which is not trivially achieved in most deployments. Therefore, while the vulnerability can cause instability, it is unlikely to enable code execution under normal circumstances.